is this a SEC managed installation? If so, policies are always assigned to groups. Thus to apply a setting to just one device you have to create an additional group for it. As you are using the term devices I assume you are talking about Central (please note that Central has its own forum). The Admin Help isn't very detailed, indeed it lists under Manage tamper protection for a specific device only Temporarily disable tamper protection. That might or might not indicate that you can't enable TP for a specific device if it's globally disabled. OTOH the How to disable ... article contains a screenshot of the System Settings that shows Note: You can enable/disable tamper protection for a specific device from its details page.
